Gambling suspicious activity reports: internal escalation

What should staff report internally?

Staff should know how to raise an unusual or concerning pattern without first proving a crime. The UKGC’s casino guidance separates internal reporting, evaluation by the nominated officer and external reporting.

A useful internal report describes facts: customer and transaction references, dates, observed behaviour, relevant records and the reason for concern. Avoid unsupported conclusions or labels. Preserve the evidence so the reviewer can assess it independently.

Who decides the next step?

Give the designated AML decision-maker access to the necessary information and a clear escalation route. In Malta, the MGA describes the MLRO’s role in analysing suspicious activity and reporting to the FIAU where appropriate.

The workflow should not depend on the commercial team approving the concern. It should also provide cover when the usual decision-maker is unavailable. Record who assessed the case and the basis for the decision, including a decision not to make an external report.

What belongs in the case file?

Use a restricted case record that supports the applicable reporting process.

• The original internal concern and time received.
• Relevant account, transaction and communication records.
• The analysis and any additional enquiries.
• The reporting decision and responsible person.
• Any external report reference and legally required follow-up.
• The account-action and communication decisions, kept within appropriate access controls.

How should customer communications be controlled?

The UKGC guidance discusses tipping off and prejudicing investigations. Staff need a communication process that respects those restrictions while handling legitimate customer enquiries.

Do not put the existence of a suspicion report into an ordinary support note visible to everyone. Provide approved escalation routes and enough information for support to handle the case appropriately, without disclosing protected details. A generic “AML hold” message should not replace analysis of what can lawfully be said and done.

Does submitting a report resolve every issue?

No. The business still needs to determine lawful account actions, any separate regulatory notifications and ongoing monitoring. A report does not automatically authorise a transaction or eliminate other obligations.

Rehearse the process with an illustrative case involving unusual deposits and a pending withdrawal. Check the handover, evidence access, decision authority and communications. Review bottlenecks and missed information. This tests the operating procedure without publishing internal detection thresholds or confidential reporting details.